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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address « 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 

- Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1)13 Responsive to connmunication(s) filed on 15 February 2002 . 
2a)n This action is FINAL. 2b)IEI This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quay/e, 1935 CD, 11, 453 O.G. 213. 
Disposition of Claims 

4) 13 Claim(s) 1-20 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) 0 Claim(s) is/are allowed. 

6) S Claim(s) 1-20 is/are rejected. 
?)□ Claim(s) is/are objected to. 

8) n Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) n The specification is objected to by the Examiner. 

10) D The drawing(s) filed on is/are: a)n accepted or b)^ objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 185(a). 

11) 0 The proposed drawing correction filed on is: a)C\ approved b)n disapproved by the Examiner. 

If approved, corrected drawings are required in reply to this Office action. 

12) n The oath or declaration is objected to by the Examiner. 
Priority under 35 U.S.C. §§119 and 120 

13) n Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 

a)nAII b)n Some*c)n None of: 

1 .□ Certified copies of the priority documents have been received. 

2, n Certified copies of the priority documents have been received In Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 

14) n Acknowledgment is made of a claim for domestic priority under 35 U.S.C. § 1 1 9(e) (to a provisional application). 

a) □ The translation of the foreign language provisional application has been received. 

1 5) 0 Acknowledgment is made of a claim for domestic priority under 35 U.S.C. §§ 1 20 and/or 121. 

Attachment(s) 

1) CH Notice of References Cited (PTO-892) 4) EH Interview Summary (PTO-413) Paper No(s). . 

2) □ Notice of Draflsperson's Patent Drawing Review {PTO-948) 5) □ Notice of Informal Patent Application (PTO-152) 

3) S Information Disclosure Statement(s) (PTO-1 449) Paper No(s) 3 . 6) □ Other: 
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DETAILED ACTION 

Information Disclosure Statement 

The information disclosure statement filed May 6, 2002 has been placed in the 
application file and the information referred to therein has been considered as to the 
merits. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner In which the invention was made. 

Claims 1-6, 9-14, and 17-20 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over U.S. patent 6,005,942 granted to Chan et al above, and further in 
view of U.S. patent 5,802,519 granted to De Jong and U.S. patent 5,883,956 granted to 
Le et al. 

Regarding claim 1, Chan teaches a smart card that includes an operating system 
capable of performing cryptographic operations (see column 4, lines 35-42 and column 
7, lines 4-9). Chan further teaches the smart card contains three types of memory (data 
storage), one of which is persistent, non-mutable memory (ROM). The operating system 
and security related code are stored in the ROM section (see column 1,line 67 to 
column 2, line 11; column 7, lines 21-24 and column 13, lines 36-48). Chan fails to 



Application/Control Number: 10/077,841 Page 3 

Art Unit: 2134 

specifically teach storing access permission data in the ROM section of the smart card. 
De Jong teaches a data structure for use in smart cards where access conditions 
(permissions) are stored in the memory means and are used to perform security 
measures (see column 8, lines 10-65 and column 12, lines 44-48). Neither Chan nor De 
Jong specifically teach the access permission data represents the availability of one or 
more cryptographic characteristics. Le teaches a secure processing unit embodied in a 
PersonCard (smart card) which uses a capability table that defines the cryptographic 
functions a secure processing unit can perform (see Abstract and column 7, line 50-et 
seq.) Le further shows the bit or bits within the capability table can specify the function 
or operating mode of a particular cryptographic operation, such as modulus size of the 
public-key pair or the allowable length of DES keys used by the particular function (see 
column 9, lines 19-58). It would have been obvious to one of ordinary skill in the art to 
combine the teachings of Le's system for configuring a secure processing unit and De 
Jong's coherent data structure for a smart card with Chan's system for a multi- 
application smart card for the purpose of designing and building a secure processing 
unit that can be reconfigured to satisfy the security requirements of various applications. 
By building only one type of secure processing unit, the production and inventory costs 
associated with manufacturing the secure processing unit can be reduced greatly [see 
Le at al; column 2, lines 41-57]. 

Regarding claim 2, Chan et al, De Jong and Le et al disclose everything claimed 
as applied above (see claim 1), in addition, Le teaches it is well known to use memory 
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devices, such as programmable read-only memory (PROM) for storing system 
capability data (see column 3, lines 61-66 and column 7, lines 51-65). 

Regarding claim 3, Chan et al, De Jong and Le et a! disclose everything claimed 
as applied above (see claim 1 ), in addition, Le teaches permissible maximum length of 
DES key (see column 9, lines 32-58). 

Claim 4 is a computer readable storage medium claim that is substantially equivalent to 
device claim 1 . Therefore, claim 4 is rejected by a similar rationale. 
Claim 18 is a computer readable storage medium claim that is substantially equivalent 
to device claim 2. Therefore, claim 18 is rejected by a similar rationale. 

Regarding claim 5, Chan et al, De Jong and Le et al disclose everything claimed 
as applied above (see claim 4), in addition, Le teaches permissible maximum length of 
DES key (see column 9, lines 32-58). 

Regarding claim 6, Chan teaches a smart card that includes an operating system 
capable of performing cryptographic operations (see column 4, lines 35-42 and column 
7, lines 4-9). Chan further teaches the smart card contains three types of memory (data 
storage), one of which is persistent, non-mutable memory (ROM). At manufacture, the 
operating system and security related code are stored in the ROM section (see column 
l.line 67 to column 2, line 11; column 7, lines 21 -24 and column 13, lines 36-48). Chan 
fails to specifically teach storing sets of data (cryptographic operations and sub- 
operations of the cryptographic operations) in the ROM section for allowing access to a 
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device external to the cryptographic device. De Jong's data structure is arranged to 
perform cryptographic operations in accordance with an external request for access and 
further performing a related sub-operation of the cryptographic operation (see column 
15, lines 15-51). Neither Chan nor De Jong specifically teach allowing access to 
instructions and/or data from a device external to cryptographic device. Le teaches an 
external bus interface between the secure processing unit and a host system. This bus 
allows commands and data to be communicated to and from the secure processing unit 
and matches standard ISA bus requirements (see column 7, lines 17-21). It would have 
been obvious to one of ordinary skill in the art to combine the teachings of Le's system 
for configuring a secure processing unit and De Jong's coherent data structure for a 
smart card with Chan's system for a multi-application smart card for the purpose of 
designing and building a secure processing unit that can be reconfigured to satisfy the 
security requirements of various applications. By building only one type of secure 
processing unit, the production and inventory costs associated with manufacturing the 
secure processing unit can be reduced greatly [see Le et al; column 2, lines 41-57]. 

Regarding claim 9, Chan et al, De Jong and Le et al disclose everything claimed 
as applied above (see claim 6), in addition, Le teaches performing cryptographic 
operations, such as encryption/deayption using public or secret key algorithms (see 
column 7, lines 37-65). 

Regarding claim 10, Chan et al, De Jong and Le et al disclose everything 
claimed as applied above (see claim 6), in addition, De Jong teaches storing sets of 
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data in read-only memory (ROM)(see column 8, lines 14-52 and column 15, lines 15- 
51). 

Regarding claim 1 1 , Chan et al, De Jong and Le et al disclose everything 
claimed as applied above (see claim 10), in addition, De Jong teaches storing some of 
the second set of data in erasable programmable read-only memory (EEPROM)(see 
column 8, lines 14-52 and column 15, lines 15-51). 

Regarding claim 12, Chan et al, De Jong and Le et al disclose everything 
claimed as applied above (see claim 11), in addition, De Jong teaches storing some of 
the second set of data in read-only memory (ROM)(see column 8, lines 14-52 and 
column 15, lines 15-51). 

Regarding claim 13, Chan et al, De Jong and Le et al disclose everything 
claimed as applied above (see claim 6), in addition, De Jong teaches storing some of 
the second set of data in erasable programmable read-only memory (EEPROM)(see 
column 8, lines 14-52 and column 15, lines 15-51). 

Claim 14 is a computer readable storage medium claim that is substantially equivalent 
to device claim 6. Therefore, claim 14 is rejected by a similar rationale. 
Claim 17 is a computer readable storage medium claim that is substantially equivalent 
to device claim 9. Therefore, claim 17 is rejected by a similar rationale. 

Regarding claim 19, Chan et al and De Jong disclose everything claimed as 
applied above (see claim 6), in addition, De Jong teaches controlling access betv\/een 
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the various sets of data within the interaction contexts (see column 8, lines 14-52 and 
column 14, lines 19-29). 

Claim 20 is a computer readable storage medium claim that is substantially equivalent 
to device claim 19. Therefore, claim 20 is rejected by a similar rationale. 

Claims 7, 8, 15 and 16 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over U.S. patent 6,005,942 granted to Chan et a! above, and further in 
view of U.S. patent 5,802,519 granted to De Jong and U.S. patent 5,883,956 granted to 
Le et al and U.S. patent 3,962,539 granted to Ehrsam et al. 

Regarding claim 7, Chan teaches a smart card that includes an operating system 
capable of performing cryptographic operations (see column 4, lines 35-42 and column 
7, lines 4-9). Chan further teaches the smart card contains three types of memory (data 
storage), one of which is persistent, non-mutable memory (ROM). At manufacture, the 
operating system and security related code are stored in the ROM section (see column 
1, line 67 to column 2, line 11; column 7, lines 21-24 and column 13, lines 36-48). Chan 
fails to specifically teach storing sets of data (cryptographic operations and sub- 
operations of the cryptographic operations) in the ROM section for allowing access to a 
device external to the cryptographic device. De Jong's data structure is arranged to 
perform cryptographic operations in accordance with an external request for access and 
further performing a related sub-operation of the cryptographic operation (see column 
15, lines 15-51). Neither Chan nor De Jong specifically teach allowing access to 
instructions and/or data from a device external to cryptographic device nor do either 
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teach the sub-operations are comprised of one or more mathematical primitive 
operations. Le teaches an external bus interface between the secure processing unit 
and a host system. This bus allows commands and data to be communicated to and 
from the secure processing unit and matches standard ISA bus requirements (see 
column 7, lines 17-21 ). Ehrsam teaches a device for ciphering a block of data using a 
cipher key wherein the mathematical primitive operation includes a divide operation 
(see column 11, line 36-et seq) and an XOR operation (see column 20, lines 15-17 and 
Figures 3a, 3b, 3c, 3d, 3e, 3f, 3g, 3h, 3i, 3j and 8). It would have been obvious to one of 
ordinary skill in the art to combine the teachings of Ehrsam's product block cipher 
system for data security, Le's system for configuring a secure processing unit and De 
Jong's coherent data structure for a smart card with Chan's system for a multi- 
application smart card in order to provide the cryptographic designer with the details of 
how the key bits within the particular permutation are to be used for generating the keys 
for the specific cryptographic operation [see Ehrsam et al; column 2, line 32 to column 
4, line 51]. 

Regarding claim 8, Chan et al, De Jong, Le et al and Ehrsam et al disclose 
everything claimed as applied above (see claim 7), in addition, Ehrsam teaches a divide 
operation (see column 11, line 36-et seq) and an XOR operation (see column 20, lines 
15-17 and Figures 3a, 3b, 3c, 3d, 3e, 3f, 3g, 3h, 3i, 3j and 8). 

Claim 15 is a computer readable storage medium claim that is substantially equivalent 
to device claim 7. Therefore, claim 15 is rejected by a similar rationale. 
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Claim 16 is a computer readable storage medium claim that is substantially equivalent 
to device claim 8. Therefore, claim 16 is rejected by a similar rationale. 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Matthew B Smithers whose telephone number is (703) 
308-9293. The examiner can normally be reached on Monday-Friday (9:00-5:30) EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gregory A Morse can be reached on (703) 308-4789. The fax phone 
number for the organization where this application or proceeding is assigned is (703) 



Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist whose telephone number is (703) 305- 
3900. 



Conclusion 



872-9306. 




Matthew B Smithers 
Primary Examiner 
Art Unit 21 34 



